An important point to note here is that PHP is server-side, as you may well know, meaning it can access any file available on the domain we’re looking at without regard for the HTTP-Authentication.
PHP cannot pass HTTP-Authentication credentials from outside the server, i.e. from the client-side, back to the server. As the server will expect the HTTP-Authentication info to come from an HTTP header (say, a GET header), from the requesting client, this hindrance eliminates any way I know of to solve this problem directly.
Two ways I can think of to solve this:
A) Have PHP alter the .htaccess file in the HTTP-Authenticated folder (‘secure’ folder) before a PHP-session-Authenticated user tries to access the secure folder. You may have to do something along the lines of:
IF USER LOGGED IN:
OPEN .htaccess FILE
REMOVE AUTHENTICATION LINE //usually "require valid-user"
ELSE:
OPEN .htaccess FILE
RESTORE .htaccess FILE'S ORIGINAL CONTENTS WITH THE AUTHENTICATION LINE INTACT
This is a simple one methinks. It’s sloppy and insecure, however, as the secure folder is available to the public every time a PHP-session-Authenticated user is logged in.
B) Let PHP open the HTML files and output their contents to the client. You may have to change your internal links so that the they point to the new script instead of the HTML files themselves.
For example, instead of a link to /secure/1.html you can have a link to fileget.php?file=/secure/1.html
fileget.php can then:
<?php
//check if user is authenticated
if(!is_user_logged_in()) {
//boot the sucka, or do what you do here :)
}
//open the file and read its contents
$fileName = $_GET['file'];
$file = fopen( $fileName, 'r' );
$fileContents = '';
while( !feof( $file ) ) {
$fileContents .= fread($theFile, 1024 * 1024);
}
fclose($file);
//output the file contents
echo $fileContents;
?>
Obviously you got to worry about CSS and Javascript linked files in here. If your HTML files have absolute links to these guys, then I think you’re fine. With relative links you may have to do some regex work in your fileget.php to handle that.
Note: You will likely have to do some verification on the $file URL parameter you’re getting, as the user can do a ‘URL hijack’ to open any of your files that PHP has access to!!!
Well, that;s what I could come up with, so I hope that helps.
If you’re interested in the A) solution at all, I have a PHP script that does just that on my local machine so I can pass that to you.
Peace,
/m